Open source and licence policy for an agent adding code

The licence policy for work here. The principle — that obligations run in both directions, with every dependency carrying terms in and the project’s own licence a decision with legal effect out — lives in the business context. This file is the policy that principle needs: which licences may enter, what they oblige you to ship, and where code is allowed to come from.

Which licences may enter

{{dependency_policy}}

Check a licence before adding the dependency, not when preparing a release. By release it is load-bearing, and removing it is a project.

Check what actually installs, not what the project page says. A licence can change between versions, and a permissively licensed package can bring a copyleft one in transitively. The question is the whole tree it adds, so read the lockfile change rather than the one name you typed.

No licence is not an open licence. A public repository without one grants no permission at all. Treat it as forbidden until somebody with authority decides otherwise.

Copyleft is the case that matters most and the easiest to miss, because it installs identically. Whether it reaches the work depends on how it is linked and what is distributed — a judgement for a person, not one to reason your way past.

What every licence obliges you to ship

Permissive does not mean free of obligations. MIT, BSD and Apache-2.0 all require their notice to travel with the software, and Apache-2.0 adds any NOTICE file the project ships. A binary shipped without them breaches every one of those licences at once.

Record every distributed dependency and its licence in {{notices_path}}. When a dependency is added, removed or upgraded, the notices change in the same commit — generated where possible, because a list kept by hand drifts from the lockfile the first time nobody remembers it.

Vendored code keeps its licence file and its headers. Copying a library into the tree does not make it ours.

Where code may come from

Code arrives from more places than the package manager, and each has terms.

• Copied snippets — answers on Q&A sites, gists, blog posts — carry the licence of where they came from, and several of those require attribution or share-alike. Record the source beside anything non-trivial that was copied, or write it fresh.
• Code from another repository, our own other projects included, carries that repository’s licence. Moving code between a public and a private project is a licensing decision, not a refactor.
• Generated code is not exempt. If output reproduces a recognisable piece of licensed code, treat it as copied: find the source, or rewrite it.

Contributions in

If this project accepts outside contributions, the terms they arrive under have either been decided or have not — they are never decided by merging. Do not merge an outside contribution whose author has not agreed to them.

What needs a person

• Adding any dependency outside the policy above, or one whose licence is unclear.
• Any change to the project’s own licence file, licence headers or copyright notices.
• Publishing code, or a repository, that has not been published before.
• Accepting the first outside contribution.